9 minute read
Risk management in the global crisis
Risk managers have served their organisations well during the global pandemic, but there is still much to do over the coming months and years
BY ARTHUR PIPER
Risk managers have played a vital role at most organisations during the current pandemic, according to IRM’s most recent survey – COVID-19 pandemic global risk management response. Of the 1,000 risk professionals taking part, 98 per cent said they were providing risk advice related to crisis decision-making – suggesting that most risk staff had not been furloughed or moved onto other projects.
Crisis management has also been holding up well for 82 per cent of organisations. One in four respondents said they were “very satisfied” that their plans had worked well, with just over half (57 per cent) saying that problems had not prevented them working more or less to expectations.
“It appears that our community is fully engaged with the pandemic response, with 98 per cent still at work and appropriately distanced – dealing with current issues and preparing for the future,” IRM chair Iain Wright, CMIRM, says. “Good technology, good communications and good leadership have been rightly highlighted as the key positive factors in maintaining operations.”
Resilience
“The survey shows that resilience is going to be a key issue for businesses going forward – the ability not just to survive, but to bounce back better,” Carolyn Williams, IRM’s corporate relations director, says. “If you
look at the news, there are some organisations achieving changes to their digital offerings, the way they use premises and how staff work that may have taken years otherwise. The future seems to be coming earlier in some areas.”
Not all organisations were well prepared though. Almost one third (32 per cent) said they had not considered a pandemic or something similar from a risk management perspective. More worryingly, of those who had, a significant minority (20 per cent) had taken no action (see If you had previously considered a global pandemic, or similar, what actions do you take?).
“For a risk community this lack of attention is high, given that it has been continuously flagged up by high-profile groups such as the World Economic Forum and the Cambridge Centre for Risk Studies,” Williams says. “It’s a weak-signal issue – the signal has been drowned out with all the other noise that has been going on. It shows that low-probability and high-impact risks do not have enough time at board level; people pull it back to what they are familiar with and what they can control.”
She says that emerging risk management needs to become part of organisations’ DNA so that they are more prepared to deal with what look like far-off risks – solar storms or the collapse of critical infrastructure – by ensuring the enterprise is able to deal with threats that involve fundamental changes to the way they need to operate.
Impacts
So far, the major impacts of the pandemic have included rapid changes to the way people work, delays in projects and recruitment, and, for some, the opportunity to enhance their reputational standing (see Has your organisation experienced the following short-term impacts?).
Anecdotally, a few organisations said that political unrest in the
UK during 2019 made them better prepared than they may otherwise have been. “We have benefited from not being complacent about reviewing potential global risks to our organisation on a routine basis, which I believe put us in a strong position to respond,” said one respondent. “Also, Brexit preparation with, for example, supply chain reviews has supported our response.”
Others said that natural disasters, geopolitical risk, people issues and climate change are being neglected too much by organisations. “For the future we expect to see a sharper focus on resilience and on strategic risk management,” Wright said. “These topics have been around for some time, but this period of crisis will focus attention on ensuring organisations have the people and skills to raise their game to what will be required in ‘the new normal’.”
The world of work could be one such area. Social distancing measures are likely to remain in place for months to come. “When staff do return to the office, they will need to find new ways of working that are consistent with social distancing requirements and may be faced with staff who are reluctant to return to work,” said Dr Jimi Hincliffe, chair of IOR, in IRM’s COVID-19 global risk management response: resilience, risk and recovery, which provides insights from a range of sectors and countries. “There will need to be more collaboration, robust governance and careful management of concentration risks, including third party suppliers.”
After
The picture could look bleak for some organisations and businesses as the world enters into an expected
recession. “The landscape is likely to involve more competition, a reduction in services and changes in societal trends,” according to IRM’s Charity Special Interest Group (SIG) – comments that could apply to many sectors. “Those that survive will need support from funders to continue in what will be an economically challenging environment, which may well lead to the scaling back of strategic ambitions.”
Second-order risks have also been crystallising. In the UK health sector, for example, one emerging area of risk already receiving attention is the number of people who may become seriously ill as a result of delayed treatment or identification of non-COVID-19 conditions during the current crisis, according to IRM’s Health and Care SIG. There are concerns over the capacity of the health and care system to provide the treatment required, especially in the event of further waves of COVID-19.
Risk management
In the IRM survey, 94 per cent of respondents believed that the experience of COVID-19 has strengthened the case for risk management. Alexander Larsen, CFIRM, chair of IRM’s Energy SIG, agrees: “Risk managers are important now, more than ever, and need to step up to the plate and show their value in helping organisations survive and thrive into the future.”
In practical terms, that means risk managers need to be considered a critical part of decision-making, providing management with upto-date risk information in order to improve the quality of its decisions. That may include identifying key risk indicators specific to the current crisis that should be monitored closely over the coming months. In addition, quantitative risk analysis should be conducted where possible in order to support decision-making, he says.
“It is important to understand that organisations need to prepare for recovery too and risk managers also play a vital part in supporting the strategic planning process (whether it be diversification, re-invention or cost cutting) by running scenario workshops, identifying risks to any proposed strategies and undertaking risk analysis of those strategies (providing an indication of likely deviations from the plan),” he says. “Risk managers can even set key opportunity indicators to provide management with the optimal time for purchasing, starting up projects or entering new territories, something that management rarely receive from a risk management department and may help in changing perceptions from that of risk management as the bearers of bad news, to a more positive view.”
Some risk managers may need to brush up their skills and knowledge. “It is critical for risk managers to also equip themselves with skills in the area of disaster management and business continuity management,” says Zanele Makhubu, CMIRM, chair of IRM’s South Africa Regional Interest Group (RIG) and a director of enterprise risk management and business continuity in the public sector. “The outbreak has made risk assessment a prominent skill and most sought-after in assisting in mitigating the virus. In our country risk managers are called to lead in advising business and government in terms of risk assessment and business continuity management.”
32% 21%
47%
No actions were taken Some actions were taken We implemented all the identified actions to ensure we were resilient in the event of a pandemic
Rapid change in objectives and ways of working
Delays in projects
Delays in recruitment
Distraction from key objectives
Loss of sales/revenue/orders
Positive reputational opportunity
Problems with suppliers
0% 20% 40% 60% 80% 100%
Major Significant Somewhat Not at all
Lessons and reflections
The challenges faced by every sector and in every country demonstrate there are lessons to be learnt (see Learning the lessons). It is important to learn lessons now so that organisations are better prepared for critical business risks arising in the future.
“The question to be asked is how did so many of us not see this coming, yet over the years, the World Economic Forum has listed the spread of infectious disease as one of the risks in the global risks heat map,” Dorothy Maseke, CMIRM, chair of IRM’s East Africa RIG, says. “The survey shows that many did not foresee the impacts that such a pandemic would bring. It should not come as a shock if in the coming years the environmental and climate change risks that have been long researched, documented and spoken about manifest just as this pandemic has. This is a lesson for the future.”
IRM would like to thank all of those who took the time to contribute to the survey and share their views in our research report at such a busy time.
• Alterations to resilience plans and the testing of them. This includes preventative measures and the capabilities in people, processes, technology and culture
• A greater understanding of the dependencies around third parties and the sensitivities in relation to resilience strategies. This includes a clear understanding of key business activities and accurately identifying the key risks and mitigation strategies
• The need to ensure there are effective frameworks to identify risks, set minimum expectations for controls and plan for critical systems and processes failing eventually
• The importance of maintaining adequate liquidity and having diversified portfolios
• An understanding of the importance of front-office activities, and the ability to quickly adapt to protect assets, employees and customers, ensuring there is a good balance between automation and manual activities
• The need for highly skilled people with diverse specialisms and professional qualifications that bring pragmatic approaches to solutions
Source: IRM Financial Services SIG; Maria Singende, IRMCert, risk manager at Barclays Bank; and Keith Webb, director of consulting, business risk at Xcina Consulting
